BlockWatchdog

Most crypto isn't lost to "hacks." It's lost to approvals people sign themselves. Here's how wallet drainers actually work — and how not to be next 🧵

Neutron's governance was bought 11 minutes before the vote closed. One wallet voted YES with 100 NTRN staked, then bought 31.62M NTRN for $20,199 and staked it. Without it, the proposal fails quorum and threshold. mintscan.io/neutron/tx/71FB9… The proposal Prop #9, "AIATO: AI Agent Takeover", was framed as an AI-governance research experiment citing an arXiv paper. Its payload was 11 MsgUpdateAdmin calls moving admin rights from the Neutron gov module to one address: six Astroport pairs, Astroport Staking and Treasury, two Drop (dATOM) contracts and a Neutron investor vesting contract. It ran expedited: 3 days, 67% threshold, 30% quorum. It was rehearsed in public. On Aug 24 the same address ran the same contract list as "TestProp: Preparation for AIATO". It got 2.9% YES. The vote At 02:13:10 UTC Sep 22 the wallet staked 31.62M NTRN bought minutes earlier, mostly from the Astroport NTRN/USDC pool that was drained an hour later. Bonded NTRN jumped from 105.24M to 136.86M. • With it: 81.9% YES, 33.3% turnout. Passed. • Without it: 40.8% YES, 13.3% turnout. Fails on both counts. At $0.000288 per NTRN, the entire bonded stake was worth ~$39K. It administered contracts holding ~$10.4M. The link Four days earlier the proposer's Cosmos Hub address sent 1 ATOM to the staker's Hub address. Four minutes later that key made its first 100 NTRN stake and cast its YES vote. What was taken (prices at 02:40 UTC) ~$10.39M: 1.59M dATOM ($4.16M), 1.72M ATOM ($3.13M), 2.85M USDC, 804K DYDX, 20 WETH, 16 wstETH. DeFiLlama carries $4.9M. Where it is • ~$5.9M never left Neutron. The IBC rate limit blocked 1.67M USDC and 14 WETH 14 times before the chain halted at 07:43 UTC. • 1,227,121 ATOM sat on the attacker's Hub address when the Hub halted at block 33,086,740, 11:18 UTC. • ~260K ATOM left earlier through deposit-style addresses. • On Ethereum the accounting closes at 694.6 ETH, and none of it has moved: 671 ETH in 0xef6c5a31df984c8569236a0abc1f27580e2a5d54, 23.59 ETH in 0xe149310eb8b1b3d9c471ccd81819d393621fba5c. Addresses Proposer: neutron1dd25c4sshelrpfs0433apg24c5phrhk8l6n605 Late staker: neutron1ekgfga6vv4zdrrjn3dux6f62fuzektfndgaehm Drainer code: code_id 5399, uploaded by the proposer at 01:18 UTC, an hour before the vote closed.

🚨 The Fetch.ai exploit has a fourth victim nobody has named: World Mobile. 500,529,231 WMTX minted through its own converter, 03:38-04:36 UTC. Different company, different multisig, no shared signers. Same compromised signing pattern. etherscan.io/address/0x63bbc… This is the part that stops being a Fetch.ai story. World Mobile's converter is 0x63bbc71c, a TokenConversionManagerV2 — the same contract family as the Fetch.ai V3 and the SingularityNET v1. Its owner is a 3-of-4 Safe at 0x9369334c. I pulled the signer list on both multisigs and compared them: zero overlap. Two unrelated organizations. What they share is the shape of the key that broke. Three signing keys, all with nothing behind them FET authorizer 0x69e5446b — nonce 0 AGIX authorizer 0x69697dac — nonce 0 WMTX authorizer 0x09578799 — nonce 0 None of the three has ever sent a transaction. A signer address that has never transacted is not sitting in someone's hardware wallet — it exists to be called by a server. Three separate projects, three keys that live in backends, all three producing valid signatures for the same attacker on the same night. That is the dependency worth naming. Not the contract. How the WMTX leg ran 504 mints, 03:38:23 to 04:36:11. 500 of them exactly 1,000,000. The recipient nets 997,000 per call, not 1,000,000 — the missing 3,000 leaves in two 1,500 fee transfers to 0xe7b81ea2 and 0x48b21074. So the per-call figure is the cap, less a 0.3% fee. Same signature as the AGIX leg: a long run of identical maximum-size calls is what a binding limit looks like from outside. WMTX totalSupply went 1,027,930,149.42 to 1,494,037,869.44. Up 466,107,720, a 45.3% increase, net of the conversions burning in the other direction. Converter balance now: zero. V2 kept the brake that V3 dropped conversionIn on this contract carries checkLimits(amount), nonReentrant and notZeroAddress. The Fetch.ai V3 version of the same function carries only notZeroAddress. That is why the WMTX leg needed 504 transactions and the FET leg needed one. The regression is specific to V3. Anyone auditing this family should diff conversionIn across versions before anything else. The number that is still open V2 enforces a maxSupply, set to 2,000,000,000 WMTX. Supply is at 1,494,037,869. 505,962,130 WMTX are still mintable, and the authorizer that signed all 504 calls has not been rotated. The minting stopped at 04:36. Nothing on-chain made it stop. Do not print the notional The two collector wallets hold 398,577,793 WMTX between them. At screen price that reads $6.45M. Total WMTX liquidity across every pool on every chain is $470,366, and most of it is the WBNB pair on BSC, not Ethereum. The realizable number is bounded by that, not by the balance. This is the third time tonight the same trap has been set. The NTX mint was reported at $462,730 against $27,400 of liquidity and returned $42,367. Read the pools, not the balance. There is a fifth Collector #2 also received 492,397,101 CGV, Cogito Governance Token, minted straight to it. Total CGV liquidity: $37. Nothing to realize, which is presumably why half of it was moved on rather than sold. Where the money actually is collector #1 0x2dcc1085fdcf418b421e45e86e4e54637cc21dfe — 632.92 ETH collector #2 0x83f4424a401a9bb75f90314f21adaea6a9ce09c5 — 83.88 ETH 716.80 ETH between them, unmoved. The FET leg alone accounts for 522.78 of it. Four token mints across three converters produced less than the single swap that started the night. Addresses WMTX token — 0xdbb5cf12408a3ac17d668037ce289f9ea75439d7 WMTX converter — 0x63bbc71c034bc99a905d5594df985c218a35d392, V2, emptied WMTX authorizer — 0x09578799fd680ffbafd3c84276d598cd3b0ac9c1, nonce 0, unrotated WMTX owner Safe — 0x9369334cc21f445731201eca008419751e4e9e5d, 3-of-4 CGV token — 0xaef420fd77477d9dc8b46d704d44dd09d6c27866 Verified at block 26,016,886, 06:19:47 UTC.

🚨 Fetch.ai/NuNet, hour 7: a third converter is minting right now. Every root-cause writeup tonight describes one contract. A second signing key was draining AGIX while they published. 140,000,000 in 14 calls, 03:13-03:17 UTC. etherscan.io/address/0x2dcc1… Credit first. PeckShield had the FET drain and the same-attacker link. SlowMist published the root cause: conversionIn() treats one EOA signature as the whole authorization, carries no burn or lock proof, and lost the checkLimits(amount) modifier that conversionOut() still has. That is correct and it is theirs. It is also scoped to one contract and one protocol. Here is what sits outside that scope. It is still running 03:13:35 UTC, six hours after the NTX mint, a different compromised wallet started calling conversionIn on the AGIX converter. Fourteen calls, exactly 10,000,000 each, last one 03:17:35. 140,000,000 AGIX, minted rather than transferred — that converter holds MINTER_ROLE on the token and its own balance never left zero. The signature on those calls recovers to 0x69697dac8ba57aa7213631133f1ea743d52e6a36, that converter's registered authorizer. A second signing key, not the FET one. Why fourteen calls and not one? The older converter still carries checkLimits on conversionIn, perTxnMaxAmount 10,000,000. The attacker is hitting the cap every time. Same codebase, two versions: the newer one dropped the brake and lost 8.72x the cap in a single transaction. The brake does not stop a key holder — it is just the only reason anyone got four minutes of warning. Selling started 03:19:47. As of 03:28:47: 5,700,000 AGIX sold for 27.44 ETH, $72,373, at roughly 17% of screen price. 40,000,000 more was just split across three wallets with zero outgoing history. 94,300,000 still sitting. Not two protocols. A keyring At least five operational keys and two signing keys from the same 2019-2021 deployment family. The NTX deployer, dormant since 2023-03-20, woke at 19:36. A NuNet LP wallet last used 2026-08-31. An ops wallet silent since 2025-05-05. A wallet dormant since 2022-01-06. A distribution operator still in service — that is the one minting AGIX now. All of them moved inside 80 minutes. One note on attribution: 0x1572f2af, listed in the alerts as the attacker, added NTX liquidity in November 2021 and was managing Uniswap V3 positions on 2026-08-31. It is a compromised wallet, not the attacker's own. Neither signing key has ever sent a transaction. A signer with a zero nonce does not live on a hardware wallet. It lives in a backend, and that is where this started. The mint landed exactly on the documented cap NTX totalSupply before: 591,467,121.866548 NTX totalSupply after: 1,000,000,000.000000 To six decimals. The published tokenomics say 1,000,000,000 NTX fixed, "with no new tokens ever minted", split across Ethereum and Cardano and held constant by 1:1 conversion. The attacker minted 408,532,878.133452 — exactly the gap to that number, which under NuNet's own cross-chain invariant is the Cardano float. Anyone spot-checking totalSupply against the whitepaper would have read 1,000,000,000 and moved on. Real aggregate supply is now about 1.41 billion. The contract is an uncapped OpenZeppelin ERC20PresetMinterPauser. Trillions were on the table. They stopped on the number that looks right. NuNet cannot undo any of it NTX DEFAULT_ADMIN_ROLE — compromised EOA, sole holder NTX MINTER_ROLE — compromised EOA, still granted NTX PAUSER_ROLE — compromised EOA, sole holder NTX paused() — false NuNet converter owner — compromised EOA, a second mint path FET conversionAuthorizer — unrotated, same key that signed the drain AGIX conversionAuthorizer — unrotated, minting eleven minutes ago The only address that can grant or revoke roles on the NTX token is the one the attacker took. It is also the only PAUSER. There is no admin recovery path in that contract. AGIX and FET token roles sit behind a 3-of-N Safe and were never exposed. NuNet's sat on a single 2021 deployer EOA. Same ecosystem, same contract family, and the gap between those two decisions is the whole incident. That Safe is the one actor who can still act — rotate both authorizers, revoke the AGIX converter's MINTER_ROLE. It has not transacted since early September. What the market actually paid The 408.5M NTX mint was reported at $462,730. Total NTX liquidity across every pool before the attack was $27,400, with 5.24 WETH of quote-side depth. 447,554,414 NTX dumped over six hours. Realized: 8.0925 ETH + 0.1665 WETH + 20,586 mUSD = $42,367. The headline is 11.0x the money. The FET leg is where the value was: 522.78 ETH on one swap, $1,378,688. The people paying are not the protocols. 591.5M NTX held by everyone else went from $0.00131 to $0.00044. $513,202 of holder value destroyed to extract $42,367. Twelve to one. AGIX is the same trap. 140,000,000 minted reads as $10.4M at screen price, against $250,978 of liquidity on the entire token, and the first 5.7M cleared at 17%. Do not print the notional. Addresses attacker — 0x2dcc1085fdcf418b421e45e86e4e54637cc21dfe, 576.62 ETH NTX deployer — 0x863f13e5b505f1eb17803b94ec9d3daf80092165, admin+minter+pauser LP wallet — 0x1572f2af7696b39c85e3221cde8efb640f86c362, compromised, not attacker ops wallet — 0xa7a31d206042b8a3e81aa4cf8c68c1b76856ee48, owns NuNet converter distributor — 0x2ddf758aa234a2dc76ea19a133d131d82ae63b3a, minting AGIX FET authorizer — 0x69e5446b07b23de0a76730062c3252152216c85c, zero nonce AGIX authorizer — 0x69697dac8ba57aa7213631133f1ea743d52e6a36, zero nonce FET converter — 0xab424a430cc09864fa1277a38193111705adf3a3, emptied AGIX converter — 0x611192364cc6962f433a5dc52cd500a423dd7be4, minting NTX token — 0xf0d33beda4d734c72684b5f9abbebf715d0a7935 owner Safe — 0x02ee7cddc3bdda9e571b5994d1adfa69b5ed4335, 3-of-N, silent Timeline, UTC 19:34-19:38 — ETH and NTX swept from five dormant and operational wallets 20:21:47 — 8,721,530.40 FET, one conversionIn, converter to zero 20:24:11 — FET sold for 522.78 ETH 20:41-20:42 — Uniswap V3 LP pulled, two SingularityAirdrop contracts emptied to the wei (6,134,102.489543 + 2,949,449.051075 = 9,083,551.540618 NTX) 20:49:35 — deployer, swept to zero at 19:36, funded with 0.000028 ETH for gas 20:50:11 — 408,532,878.133452 NTX minted, supply hits 1,000,000,000.000000 02:27 — NTX dumping ends, 447.5M sold 03:13:35 — AGIX minting begins 03:17:35 — 140,000,000 AGIX 03:19:47 — AGIX selling begins 03:25-03:26 — 40,000,000 AGIX staged across three fresh wallets State verified at block 26,016,034, 03:28:47 UTC. Every line is one eth_call or one log query. Check them.

The "$7.8M rsETH exploit" hit a $144M Aave loop — and the attacker took exactly the room it had left. 2,900 rsETH moved the Safe's health factor from 1.0587 to 1.0012. The attacker's only paid haul came 69 minutes later, from a second Safe. The victim, 0x40e93a52…aba8, held 53,402 aEthrsETH against $129.4M of WETH debt. Aave only lets aTokens move while HF stays ≥ 1, so the take was capped by collateral × 0.95 − debt ≈ $7.99M. The attacker took 98% of it. Blockaid named the path: a publicly callable keeper multicall steered the Safe's Uniswap v4 LP module into an attacker-made pool (the fake token is literally called "Permissionless Attacker Token"). What happened next: Yoink didn't copy the exploit. The attacker's contract paid whoever called it, and the bot called it one block after the attacker's own prepare(). Kelp has since frozen the bot's 2,882.37 rsETH until Sep 16 05:25 UTC. The modules stayed enabled for 81 minutes. Four more parties drained the leftover headroom in 50, 9.5 and 0.5-rsETH bites, down to HF 1.00000. Then Yoink liquidated the victim: 168.83 WETH repaid, 157.707 rsETH seized. Accounting closes to the wei: 53,402.655 − 2,966 drained − 157.863 liquidated = 50,278.79 aEthrsETH left. The attacker walked away with none of the rsETH. At 05:47 UTC the same multicall emptied Safe 0x6a1fac6b…7ea2: 86,631.95 DUSD + 38,248.16 USDC (~$128.8K), sold for 23.69 ETH, and 23.6 ETH went into LI.FI. Gas was funded from Railgun. Four Safes ran on this keeper contract. Two were hit. Addresses Attacker: 0x0dc2c5d6b05a317076cf501f7e7be36a5dfe9b66 Keeper multicall: 0x4f0055926c839d1d960a82cbf84e2ee933958ebc Victim 1 (rsETH loop): 0x40e93a52f6af9fcd3b476aedadd7feabd9f7aba8 Victim 2 (DUSD/USDC): 0x6a1fac6b3466e29421f70d6eaa91a0de0f627ea2 Yoink proceeds (frozen): 0xc70f00cd7e461686b04b0e912e309beca8b80ea0 Evidence Exploit (Yoink): 0x0e7680b06cb8a6f86c149d9ba90d98e3d334e7b072dde03909d43fcfd98a8705 Liquidation of victim: 0xe77f7513547d917e86e2ac8457b00e9f4336fee3908b9a674095603d467cde66 Second Safe drain: 0x850342386d7446e3ce479ecc246e843961a46fa6540d279a5ef602d14deb547e Modules disabled: block 25980931, 06:00:11 UTC Liquidation of victim: etherscan.io/tx/0xe77f751354…

Liquid: Blockstream agreed to the return at 03:16:04 UTC. 93 minutes later the chain stopped producing blocks. It has not produced one since. The agreement is a PGP signature in an OP_RETURN. It verifies against Blockstream's key. Nobody has to take my word for any of this. Every claim below is a command you can run. ━━━━━━━━━━━━━━━━━━━━━━━━ THE NEGOTIATION, AND WHICH HALF OF IT IS REAL Three messages arrived at the attacker's address from a single sender, bc1qn8mgsmxx42j3fflqfkh0cqhdd6mj4h9q2mfqym. Two of the three carry a PGP signature. Both verify against the key published at blockstream.com/pgp.txt — fingerprint 1176 542D A98E 71E1 3372 2EF7 4AC8 CC88 6844 A2D6, "Blockstream Security Reporting". 19:31:47 UTC blk 965822 "Please contact [email protected]" (unsigned) 01:49 blk 965865 detached PGP signature + an encrypted blob SIGNATURE OK 03:30:05 blk 965875 clearsigned "Yes, thank you." SIGNATURE OK Because all three came from the same address, the first one is now authenticated too. It had been an assumption. It is not any more. The attacker's side, spending from the consolidation address: 18:30:10 UTC blk 965818 "we are whitehats. contact us on chain" 02:20:18 blk 965869 "sending most back to bc1qdlld6…, is that ok" 03:30:05 blk 965875 "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix." + a PGP message encrypted to Blockstream's real subkey BB332D31CBA44EDF Blockstream's signature on "Yes, thank you." was made at 03:16:04 UTC — between the attacker's question and the attacker's reply. That is an answer to "is that ok", and the answer is yes. The 01:49 blob is Electrum BIE1 ECIES, encrypted to the public key recovered from the attacker's own spending signature. 101 bytes: 4 magic, 33 ephemeral pubkey, 32 HMAC, 32 of AES-CBC. Whatever Blockstream said privately is at most 31 characters long. ━━━━━━━━━━━━━━━━━━━━━━━━ THE SIGNAL HANDLE IS NOT PART OF THIS CONVERSATION At 20:38 UTC an OP_RETURN reading "Please contact us on Signal @m671aw.70" was paid into the attacker's address. It is unsigned. It came from bc1q7le6nr37p892jzlyugr5sl29pfcg27xl77eafu — a two-transaction throwaway holding 0.00100893 BTC — and not from the address that carried Blockstream's two verified signatures. It burned a 31,800-sat fee, roughly twenty times what the real messages paid. It is inbound, unsigned, and from a stranger. Treat it as such. It is not alone. The same address has been pelted for a day with a memecoin contract, a Monero swap desk offering to launder "$700M+", a referral link advertising itself as "the biggest one to launder money", a wallet vendor running four different ad creatives, and a New York lawyer offering pro bono counsel for a clean return. The attacker has answered none of them. ━━━━━━━━━━━━━━━━━━━━━━━━ WHAT ACTUALLY LEFT: 3,996.01834922 BTC The figure in circulation is 4,019 or 4,002. Both are the transaction, not the theft. 8db751a650ae2f12006b7e8c69a75e4df360e8afd6b9e05ae0b9fa6458a7b140, block 965783, 2026-09-06 14:28:56 UTC, 83 inputs, 13 outputs. Ten outputs are change to the federation. Three are payments: 3996.01834922 → bc1qgslsydz56d0ed6827hdemfmk5w2f6ldyc6wt7p 2.65138358 → bc1qkxwva32eh7mgezq5kladncd3n5wtcjmslh98my 3.99601658 → bc1qk3cvk5599nydy8zwavlxaduke54pgf4vl0ckru I spend-traced all three. The second and third go to unrelated clusters and never touch the attacker's wallet. They are ordinary customer withdrawals. The functionaries batched a fraudulent peg-out into the same Bitcoin transaction as two real ones, which is exactly why nothing looked wrong at the time. The first output moved on in the same block. 85d2ca15… forwarded 3,995.99999857 BTC to the consolidation address and split off 0.01834922 BTC to a side address — leaving a round 3,996 BTC, less a 143-sat fee. Somebody wanted a clean number. The consolidation address shows 15,993.99 BTC of inflow. That is one pile counted four times: it paid itself in blocks 965783, 965818, 965869 and 965875, attaching a new message each round. Read the page cold and you overstate by 4×. It holds 3,998.49854728 BTC and has not moved. ━━━━━━━━━━━━━━━━━━━━━━━━ THE KEYS WERE NEVER THE PROBLEM I decoded the witness on all 83 inputs. Every one is identical: eleven signatures against the 11-of-15 functionary branch. The witnessScript hashes to the scriptPubKey, so there is nothing to argue about. OP_11 <15 pubkeys> OP_15 OP_CHECKMULTISIG OP_IFDUP OP_NOTIF 8064 OP_CSV OP_VERIFY OP_2 <3 emergency pubkeys> OP_3 OP_CHECKMULTISIG OP_ENDIF The emergency branch — the 8,064-block timelock and the 2-of-3 recovery keys — was never touched. No key was stolen and no key was abused. Eleven honest signers approved a withdrawal that had been made to look valid one block earlier, on the other chain. ━━━━━━━━━━━━━━━━━━━━━━━━ THE HALT WAS TWO EVENTS, NOT ONE "The sidechain is paused" describes the first one. It does not describe what happened this morning. 00:16:10 UTC Liquid block 4050959 — the last user transaction. From here, 273 consecutive empty blocks. This is the bridge-node shutdown. 04:49:10 UTC Liquid block 4051232 — block production stops entirely. As of 06:42 UTC that is 113 minutes without a block on a chain that mints one every sixty seconds. Three probes twenty seconds apart returned the same tip. The empty-block run needed a baseline, so I took one: across the 2,160 blocks of the thirty-six hours before the incident, the longest natural run of empty blocks was 43. The current run is 273 and it is a different animal. Note the order. Blockstream's signature: 03:16:04. Block production stops: 04:49:10. Ninety-three minutes. Sequence is not cause and I am not claiming it is — but the signers were stood down after the agreement, not before it. Also worth keeping: the first stage arrived 9 hours 47 minutes after the Bitcoin left. The federation kept paying ordinary peg-outs for 2 hours 20 minutes after the drain. ━━━━━━━━━━━━━━━━━━━━━━━━ THE BOOKS BALANCE. THAT IS THE PROBLEM. The federation reserve held 4,205.29404448 BTC before the drain. It holds 197.47187814 now — 4.70% of what it had. Now ask an explorer whether L-BTC is backed: L-BTC supply, before 4,205.01883617 reserve 4,205.29404448 L-BTC supply, after 197.29721457 reserve 197.47187814 Fully backed at both ends, to the fourth decimal, with the same small surplus. Anyone running the obvious solvency check sees a healthy peg. The check is broken, and it is broken by design. L-BTC amounts are confidential, so no explorer can sum the UTXO set. Supply is derived as peg-ins minus peg-outs minus burns. The counterfeit L-BTC was destroyed by the peg-out that stole the Bitcoin — so it passed through the burn counter as if it had been legitimate. The identity that is supposed to expose a shortfall is the thing that absorbed it. The two nodes disagree by exactly 4,007.82183916 BTC of peg-outs. That resolves into 4,002.66609035 (the drain) + 4.14039943 + 1.01571202 (two ordinary batches afterwards), closing to 0.00036264 BTC. No leg is missing. ━━━━━━━━━━━━━━━━━━━━━━━━ TWO NODES, TWO OPINIONS ABOUT WHAT IS TRUE The explorers disagree, which has been reported. Where they disagree has not. Query the same three objects against both: Liquid block 4050336 blockstream 200 mempool 404 tx c652a104… (the mint) blockstream 200 mempool 200, "confirmed": false tx ce4caece… (the peg-out) blockstream 200 mempool 404 mempool.space's node is holding the transaction that created the money in its mempool, as unconfirmed, sixteen hours on — while returning 404 for the block that contains it. It accepted the transaction under its relay policy and refused the block. The split is at block validation, not at relay. And that node is alive, not crashed: it is serving a 460-transaction mempool. Its chain tip is frozen at 4050335, one block before the mint. ━━━━━━━━━━━━━━━━━━━━━━━━ WHAT I CANNOT TELL YOU How much was minted. c652a104… has 64 confidential inputs and 5 confidential outputs and a 479-sat fee. Only what left the peg is visible: 3,996.01834922. If counterfeit L-BTC is still sitting in that wallet, it is a second claim on a 197-BTC reserve, and it is frozen only for as long as the chain is. Which bug. Elements shipped a cluster of confidential-value soundness fixes on 1 September, and they reached the production branch on 6 September at 17:20:55 UTC — two hours and fifty-two minutes after the money was gone. One of them, buried in a PR titled after RPC error handling, made peg-out authorization apply to blinded assets; before it, PAK enforcement was skipped outright whenever a peg-out's asset commitment was confidential. That is a real hole and it was real for years. It is not this one: I checked ce4caece… and its peg-out output carries an explicit asset and an explicit value, so PAK ran normally. The lie is in the mint, not in the authorization. And note what the attacker said at 03:30 this morning, ten hours after that patch landed: the chain is under risk at latest commit right now. ━━━━━━━━━━━━━━━━━━━━━━━━ VERIFY IT YOURSELF curl -s blockstream.com/pgp.txt | gpg --import # pull the OP_RETURN from block 965875, strip to the armor, then: gpg --verify yes.asc curl -s liquid.network/api/tx/c652a1…\ 42fa552b0856ba674/status curl -s liquid.network/api/block-hei… ADDRESSES federation bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr attacker bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte Blockstream bc1qn8mgsmxx42j3fflqfkh0cqhdd6mj4h9q2mfqym Signal spoofer bc1q7le6nr37p892jzlyugr5sl29pfcg27xl77eafu mempool.space/address/bc1ql4… The mechanism and the explorer split were first laid out by defiprime, and the range-proof cache commit is their find. What is added here is the cryptography on the negotiation, the composition of the drain transaction, and the second halt. All times UTC. Reserve, supply and tip figures read at 06:42 UTC, 7 September 2026.

NOTIONAL FINANCE — $1.73M OpenZeppelin flagged the exact line that drained it. In December 2020. Finding L10. Severity: Low. Never fixed. 2,082 days later it emptied the escrow in 337,254 gas. THE LINE The bug is not in mintfCashPair, which is what the alerts named. It is one cast inside the Escrow's ExchangeRate library, compiled with Solidity 0.6.4 — before the compiler checked arithmetic for you: uint128 absBalance = uint128(balance.abs()); balance is an int256. abs(-2^128) = 2^128. uint128(2^128) = 0. Seven lines further down, the same function wraps its result in SafeCast.toUint128. The codebase has eleven correct SafeCast calls in Liquidation.sol alone. Somebody swept this repository for unsafe casts and stopped one line short, twice — the identical statement sits in _convertETHTo as well. The OpenZeppelin audit of Notional V1, dated 22 December 2020, is finding L10, "Casting between types without overflow checks." It names the function by name: "Within the functions _convertToETH on line 49 of ExchangeRate.sol and _convertETHTo," the int256 balance input is explicitly cast to a uint128. The recommendation was to use SafeCast. The escrow implementation went live on 7 December 2020 — fifteen days before that report was published — and the proxy emitted exactly one Upgraded event in the following 2,096 days. The audited line was never touched. THE PROOF, IN ONE CALL Point an archive node at the block of the setup transaction and ask Notional what the attacker's account was worth: cast call 0x0a4721117040abf319b954abf13f654505c34920 \ "freeCollateralView(address)(int256,int256[],int256[])" \ 0xec434a2f9b7b93aad1bed77d6bc512a75ae90d78 \ --block 25900220 fc = 0 balances[1] = -340282366920938463463374607431768211456 That second number is exactly -2^128, denominated in DAI. An account carrying 340 undecillion DAI of debt reads as precisely zero free collateral, so require(fc >= 0) passes. The attacker's own contract asserts it: the constructor reverts unless free collateral comes back as 0. WHY TWO CALLS, AND WHY EXACTLY 2^128 ERC1155Trade.safeTransferFrom carries require(value <= MAX_UINT_128), so a single position can never reach 2^128 — it stops one short, at 2^128-1, and one short does not wrap. The DAI cash group has numMaturities = 2. Exactly two slots in the cash ladder, and the free-collateral routine sums them before converting to ETH. He filled both: notional 1 at the near maturity, notional 2^128-1 at the far one. 1 + (2^128-1) = 2^128. That single unit of fCash — worth one billionth of a DAI — is the entire exploit. Without it the sum is 2^128-1 and nothing truncates. The mirror leg is why the trade is profitable rather than merely broken. The counterparty account received +2^128-1 of the same fCash. Positive balances get haircut before valuation, and the haircut lands it at 0xe07024b1071fe9632caee3275fa315e6 — 0.8767 x 2^128. Just *under* the wrap point, so it survives intact and reads as +1.9e35 wei of collateral. The debt lands exactly *on* the wrap point and disappears. One number gets erased. Its mirror does not. That asymmetry is the whole $1.73M. A WINDOW THAT OPENS ONCE A QUARTER The near maturity is 1,788,480,000 — exactly 00:00:00 UTC on 4 September 2026, and exactly 230 quarterly periods of 7,776,000 seconds. The setup transaction confirmed at 23:58:47 UTC. Seventy-three seconds before it. mintfCashPair requires blockTime < maturity, so the position has to be minted before the boundary. Withdrawing requires the fCash to have matured, so settleMaturedAssets can turn it into a cash balance. Those two conditions cannot hold in the same block. This attack is structurally two transactions straddling a maturity boundary, and that boundary opens once every ninety days. Which is also why the transaction every alert linked — the one at 23:58:47 — is not the one where the money moved. THE MONEY 21:41:35 1.18197 ETH arrives from an unlabelled service wallet 23:58:47 setup: contract deployed, -2^128 liability minted 00:01:35 drain: 69,257.37 DAI + 1,658,524.86 USDC — 100% of the escrow 00:03:35 proceeds forwarded to a second address 00:29:35 689.2 ETH fully inside Tornado Cash Twenty-eight minutes from drain to laundered. The forwarding address is an EOA running an EIP-7702 delegation to MetaMask's EIP7702StatelessDeleGator, batching swaps through LI.FI via ERC-7821 execute() — four of his six swap attempts reverted before two landed. The stablecoins cleared at $2,510.67 and $2,514.99 per ETH. Tornado took the proceeds in 25 deposits: six of 100 ETH, eight of 10, nine of 1, two of 0.1. 689.2 exactly. The funding wallet is not labelled anywhere, but its shape is unambiguous: 1,000 transactions in a single day, 419 distinct outbound counterparties against 289 distinct inbound, 99.1% of its ETH amounts non-round, every token movement a bare transfer(). A swap-service payout wallet. It was itself seeded on 6 November 2024 from Binance 18, and has never touched Tornado Cash in its entire history. THE RESPONSE NOBODY REPORTED Notional's account has not posted since 8 April. Every outlet covering this wrote that the team had said nothing. They said nothing. They did something. At 03:35:47 UTC an EmptyProxy stub was deployed. At 04:04:47 the Notional V1 multisig — the same Safe that deployed these contracts in 2020, dormant since 21 March 2025 — executed a transaction to itself carrying zero value and zero calldata. Eighty-four seconds later, at 04:06:11, it pushed the escrow proxy onto the stub. Four hours, four minutes and thirty-six seconds after the drain. Three hours and thirty-seven minutes after the last Tornado deposit cleared. Between those two events, at 01:09:11, somebody else flash-loaned 15,000 USDC from Morpho Blue, deployed a single-use contract and settled fourteen separate accounts against the now-dead market, pulling 5.67 WETH back out of the escrow. WHAT IS STILL IN THERE 14,211.894948 USDC 18.216201470486059607 WETH 0.00499717 WBTC 0 ETH Not stranded. The stub is not actually empty — it keeps an owner-gated transferTo(token, to, amount), and owner() resolved through the proxy returns that same multisig. The team can sweep it whenever they choose. Every user-facing withdrawal path in Notional V1, however, is now gone. And the escrow was not an abandoned husk. A real depositor put in 1,173 DAI and 952 USDC and took out WETH on 15 July 2026. Another withdrew USDC on 27 August, eight days before the drain. ADDRESSES Attacker EOA 0xdacc235a494750193695a111d715c2ca12b5ce38 Exploit contract 0xec434a2f9b7b93aad1bed77d6bc512a75ae90d78 Forwarding EOA 0x8aaf01b6f9acc973274b8718be4d1c1be10e3be6 Tornado funnel 0xc95496c917a41a394efdac3e0882f5903d24de69 Notional Escrow 0x9abd0b8868546105f6f48298eadc1d9c82f7f683 Vulnerable impl 0x8a134e651432a902041643668940c9a9cd270633 Portfolios 0x0a4721117040abf319b954abf13f654505c34920 V1 multisig 0x22341fb5d92d3d801144aa5a925f401a91418a05 Drain transaction: etherscan.io/tx/0xc3f3e318f7… Low severity findings are still findings. This one waited 2,082 days.

AQUIFER — SOLANA, 31 AUG 2026 Coverage says Aquifer's contracts were not exploited and points at wallet compromise. All 212 drain calls invoked a program the attacker deployed 5m31s earlier. Aquifer never checks the program it calls. solscan.io/tx/59FaTv9PG7rbaf… THE BUG Aquifer's swap instruction takes the SPL token program for each leg out of the caller's account list and CPIs it without checking that it is the token program. Proof, one instruction, 04:04:18 UTC: top level AQU1FR... data 01 920dd28f2a000000 discriminator 1, amount_in 182,801.534354 USD1 CPI 1 spl-token transfer 182,725.676811 USDC from vault 7ULN1YSsJ3tnC98PVko7qTS5iGzX73QY74vgMeHjwvkW authority GtwzYxBQcPFNFQcYbdELuaKzb4DGJpGVU2ehLhzbffCw (Aquifer PDA) to the attacker's ATA CPI 2 DMBpPMaMpGM2mWiUMaqcHx9FwhPg9Ys7qg1X59NRgb68 data 03 920dd28f2a000000 byte-for-byte an SPL Token "Transfer" for the same amount 858 compute units, no state change DMBpP... is not the token program. It is a 20,424-byte program the attacker deployed himself at 03:35:56 UTC, upgrade authority = his own wallet. The "source" account it was handed, Fd3ug1B14aedt6NGpiC55mXgHT3L9cspYBitcooAy6EV, is 165 bytes — SPL token-account layout — owned by DMBpP... rather than by the token program. The pool paid out real USDC and received nothing. Not a key compromise. A missing owner check on a program account. 212 of 212 successful calls have exactly this shape: Aquifer discriminator 1, two CPIs, one real transfer out (195x spl-token, 17x Token-2022) and one call into DMBpP... for the paying leg. No exceptions. THE PREPARATION 01:21:22 wallet funded with 2.3649 SOL from an instant-exchanger hot wallet, memo "087b7ae2" 03:35:06 20,461-byte buffer created, 24 write chunks 03:35:56 DMBpP... deployed 03:36:01 45 transactions, one per mint: a fake 165-byte "token account" owned to by DMBpP..., for 45 different assets. All 18 pools he later drained 03:37:44 are in that list — the target set was chosen before the first call. 03:41:27 first exploit call Five minutes thirty-one seconds from deploy to first drain. THE 40 MINUTES 03:41:27 first call: $4,931 (195,849 KMNO) 04:04:00 22m33s and 26 calls in — $75,728 taken, 3.1% of the eventual loss 04:08:25 25% mark 04:09:43 75% mark — half the entire loss moved in 78 seconds 04:21:19 last call 212 calls, 18 pools, $2,444,568 priced at 04:20 UTC. DeFiLlama's registry says $2,469,729 — a 1% gap, from two different price sources rather than two different reconstructions. THE ACCOUNTING All 18 drained vaults together hold $69.69 today. Not a partial drain — every pool went to zero. The SOL side closes too: 24,085.17 SOL in from the swaps, 24,085.02 out, 0.15 left behind. THE OFFER IS REAL Worth stating, because a fake whitehat offer is the standard follow-up to a public one. This one checks out. The memo transaction u1hoSUTz... (16:43:27 UTC) executed through Squads v4, logging "Signed by 8pJhHxPQRiUGdtVSCNPyP9AH994zeyYEBGb5yZRzheSA", with a 1-lamport transfer from that same account to the attacker. Reading the program directly: getAccountInfo AQU1FRd7pap... -> programData GrHYWjuGETV5pZgUZLfzvvQEugYk6SutwHUPxFjrHda6 getAccountInfo GrHYWjuGETV5... -> authority 8pJhHxPQRiUGdtVSCNPyP9AH994zeyYEBGb5yZRzheSA Same key. The offer really is from the holder of the upgrade authority. The Ethereum mirror landed at 16:50:47 UTC from 0x09dA08045830492B24b3b8A0022375e662bbE91d. THE ANSWER 24,084.479 SOL left Solana in three legs through Rango, the route ending in Circle CCTP v2, and came back as 1,000.7955471888082 ETH — 871.860 + 122.509 + 6.426 — with 45 to 60 seconds of solver latency per leg. Then it sat for 27 hours 54 minutes. On 1 September at 20:37:23 UTC the whole stack moved in a single transaction to 0x200e52350fbc579c96bad87b6ef782c1f962dffd — a fresh vanity EOA with no prior history, no outgoing transaction, and a balance today of exactly 1,000.7955471888082 ETH. That is 41 hours 23 minutes before the 3 September 14:00 UTC deadline, and it is the answer to the offer. Nothing reached either recovery address: the Solana one has held 0.98 SOL and been silent since 9 February; the Ethereum one has not moved. THE POISONERS Twelve seconds after that transfer a fleet started mirroring the payee. Fake ERC-20 contracts named "ETH", "EߠH" and "Ether.." emitted transfers of exactly 1,000.7955471888083 from the attacker to 0x200aceda1b..., 0x200ef02e9c..., 0x2000d091d2... and 0x200e3afa6b... — and one to the real 0x200e52350f..., so the lookalikes sit in the history beside a genuine entry. Then 1-gwei dusts from the same set. Every address is 200...dffd. They copy the payee, not the victim. The same thing happened on Solana: 7fTeniVLMFsaP5EXC4e2yZL62msxh4yTGyiChVUEERNJ — same four-character prefix as the attacker's 7fTe9pvr... — dusted the Rango escrow at 04:28:00, six minutes after the last leg passed through it. And on 1 September at 10:59 someone wrote to the attacker from 0x378ce730a46c04b28168f3e4bf78af23b317de79 asking him for 10 ETH. STILL THE SAME BUILD The Aquifer program has not been upgraded since 11 August 2026, 11:51:44 UTC — programData last_deploy_slot 438601204, and nothing after it in the loader's history. The vaults are empty, so there is nothing left to take; the point is that the build on chain is the one that was drained. ADDRESSES attacker (SOL) 7fTe9pvrwXJRBHq9MaSyVPR4PgEuhqLiA93Dxf4gRk7J attacker (ETH) 0x2Dfe9e969796e2797278b02761dd9Ad6aE922746 attacker program DMBpPMaMpGM2mWiUMaqcHx9FwhPg9Ys7qg1X59NRgb68 fake token acct Fd3ug1B14aedt6NGpiC55mXgHT3L9cspYBitcooAy6EV Aquifer program AQU1FRd7papthgdrwPTTq5JacJh8YtwEXaBfKU3bTz45 upgrade authority 8pJhHxPQRiUGdtVSCNPyP9AH994zeyYEBGb5yZRzheSA 1,000.79 ETH now 0x200e52350fbc579c96bad87b6ef782c1f962dffd The incident and the two attacker addresses were first published by Defimon and covered by crypto.news on 1 September. The mechanism above is ours.

CertiK and PeckShield put the Tectonic hack at $74-75M. That's only the stablecoins sent to one address. Tectonic's own market balances fell $119.1M. $42.4M of it sits in a contract nobody has named: 0x085f3115ca368aa262246d22f9476e1e2c87e8be I reconstructed the whole thing from Cronos archive state, because the public explorer is down and the chain is still halted. ── THE ADDRESSES NOBODY NAMED ── Attacker EOA: 0x4266a0e6a0f0ef90abcff3bb089932ca0cce3652 Orchestrator contract: 0xd3aac8a1a9e412e2c590463a8b6f90125e23f1f3 (deployed Aug 30, 12:38:56 UTC) Borrower contract: 0x2dc6a36f4e5eeefe112c01569de96dea496bb618 (created in the same tx) Vault contract: 0x085f3115ca368aa262246d22f9476e1e2c87e8be — deployed by the same EOA on Aug 18, 14:47:15 UTC. Twelve days before the exploit. It currently holds 13,978,766 USDC, 9,812,697 USDT, 92.04 WBTC, 1,765.10 WETH, 32.93 CDCBTC, 349.67 CDCETH, 23,093,728 LCRO, 24,287,549 WCRO and 120,650 XRP. About $42.4M. Starting capital: 5,000,950 USDC, bridged onto Cronos in $100-500K tranches between Aug 28 and Aug 30 through 0xcdfba496180865a71266608ade6b21ab1f788888. ── WHY $74M IS THE WRONG NUMBER ── The drain transaction is 0xddc9dc47d330116332ae687ba939f6d6196c4cc5950b2cdb04ae826520eeca20 One call. Selector 0x26faf313 — borrowMax(). It borrowed the entire cash of every market, matching each market's cashPrior to the unit: USDT 34,238,092.49 → 0x7d4e $34,235,145 USDT 11,412,697.50 → 0x085f $11,411,715 USDC 41,429,611.35 → 0x7d4e $41,427,963 USDC 13,809,870.45 → 0x085f $13,809,321 WBTC 98.04 → 0x085f $7,713,270 WETH 1,895.10 → 0x085f $4,669,805 CDCBTC 32.93 → 0x085f $2,590,723 LCRO 26,243,727.70 → 0x085f $2,104,797 CDCETH 379.67 → 0x085f $1,005,170 WCRO 16,745,476.51 → 0x085f $1,028,641 XRP 270,650.42 → 0x085f $378,736 ─────────── $120,375,285 Stablecoins were split exactly 75/25 between 0x7d4e and the unnamed contract. Everything else went to the unnamed contract at 100%. 41,429,611 + 34,238,092 = $75.66M. That is the "$75M at three addresses." Both firms counted the 75% slice of two assets and stopped. Tectonic's market cash, before the attack vs. at the halt, priced with the protocol's own oracle from before the manipulation: tUSDC 54,325,388.59 → 0.03 -$54,320,567 tUSDT 45,550,247.50 → 966,882.66 -$44,579,503 tWBTC 98.18 → 4.45 -$7,361,887 tWETH 1,885.07 → 34.28 -$4,564,140 tCDCBTC 33.30 → 0.13 -$2,605,552 tCRO 46,053,295.86 → 1,977,118.96 -$2,536,848 tLCRO 26,880,464.61 → 3,147,757.71 -$1,783,431 tCDCETH 380.79 → 0.65 -$1,007,191 tXRP 270,650.42 → 8,213.53 -$366,692 ──────────── -$119,125,811 tUSDC has three cents left in it. ── IT WAS NOT AN ORACLE TRICK IN ONE BLOCK ── Setup tx: 0x0fce5ae8d2eeb82c838e750d0e25af1564a2c7d05bf843dd1cfea102ce587d06 — 33.2M gas, 677 logs. 1. Deposit 5M USDC as tUSDC. CF 0.8 → ~$4M of borrowing power. 2. Borrow the entire tTONIC market: 3,844,366,314,940.79 TONIC, worth ~$4.08M at the real price of $1.0622e-8. Right at the limit. Nothing broken yet. 3. Re-deposit that TONIC through the second contract. 4. Repeat. And after 12 loops the mint stops being necessary — the borrower simply sends TONIC to the tTONIC contract as a plain ERC-20 transfer. Cash refilled, no accounting event, borrow again. 98 iterations. End state of one transaction: — parent debt: 376.5 trillion TONIC — child collateral: 309.2T tTONIC = 335.7 trillion TONIC TONIC's total supply is 500 trillion. The attacker's collateral claim was 67% of every TONIC in existence, and 14.7x all the TONIC sitting in every DEX pool combined. Those pools held about $0.5M across both sides. tTONIC's totalSupply went from 60.06T to 369.26T in that single transaction. One address created six times more deposits than existed before it. ── THE SECOND INFLATION NOBODY MENTIONED ── In Compound v2, exchangeRate = (cash + totalBorrows - reserves) / totalSupply. Outstanding borrows count as assets of the market. So the attacker's own unbacked 376.5T TONIC debt landed in the numerator of the token he was posting as collateral. tTONIC's exchange rate went 1.354e9 → 1.0857e10 in that one transaction. An 8x jump. Roughly 95% of the tTONIC market's balance sheet was the attacker's own debt. ── THEN THEY JUST WAITED FOR THE FEED ── Three follow-up transactions (12:40:39, 12:41:29, 12:45:25, selector 0x7b9f30b8) each borrowed USDC and CRO against the inflated collateral, bought TONIC on VVS with it, and donated the TONIC back to the tToken contract. Total fed into the pools: 3,509,440 USDC + 28,163,915 CRO ≈ $5.24M — all borrowed from Tectonic itself. The first attempt at 12:40:39 reverted; they adjusted parameters and retried. TONIC's price in Tectonic's oracle (0xd360d8cabc1b2e56ecf348bff00d2bd9f658754a), block by block: $1.0622e-8 baseline $6.8593e-8 after the setup tx $9.1889e-7 around block 90,896,600 $2.0763e-6 around block 90,897,080 ──────────────────────────────── x195.5 in about four minutes The price is flat between updates and then jumps. This is a pushed feed that follows the manipulated DEX price with a lag. The attacker never had to beat an oracle inside a block — he bought TONIC and waited for the feed to catch up. Collateral value of the borrower contract as it moved: 12:38:56 $3,565,813 12:40:39 $23,026,727 12:45:25 $314,381,596 12:49:39 $710,376,013 At a 0.2 collateral factor, $710M of collateral is $142M of borrowing power. They took $120M and left. ── WHERE THE MONEY IS ── At block 90,907,150, the moment Cronos stopped: 0x7d4e...f2dc — $60,115,712 0x085f3115... — ~$42,410,000 0x215adfc8... — $7,770,094 USDC Ethereum 0xc404160b... — 2,592.215 ETH ≈ $6,390,000 ───────────── ≈ $116.7M One correction to every tracker showing 0x7d4e: a token scan shows it empty. The $60.1M is a 75.008% LP position in the VVS USDT/USDC pool 0x39cc0e14795a8e6e9d02a21091b81fe0d61d82f9. Thirty million USDC and thirty million USDT went in, LP tokens came back. ── THE HALT DIDN'T CATCH THE ETHEREUM LEG ── Between 13:03:23 and 14:15:47 UTC, 6,336,359.647494 USDC moved to 0xc404160b79bd8905061a1caecbeca2eeab3f72dd on Ethereum in 34 tranches, relayed by 0xf70da97812cb96acdf810712aa562db8dfa3dbef — an intent-bridge solver that also appears on the Cronos side, not the canonical bridge. Every cent was swapped into ETH through the Uniswap v3 USDC/WETH 0.05% pool. 2,563.22 ETH received, average $2,472.02. Cronos halted at 14:32:47 UTC — 1 hour 43 minutes after the drain. That address was still swapping at 01:43 UTC the next day. Balance now 2,592.215 ETH. ── A WARNING ON THE ADDRESSES IN THOSE ALERTS ── Minutes after the drain, address-poisoning bots mirrored the transfers with counterfeit USDC and USDT (0xa9f071191cc59b4a0a970dca02a16ddfe803719b, 0xc6203d86f5efbed7f9512755f3e6132ee50d03d1) sent to lookalikes: 0x7d4eb7d6fd2bd97ffa042fe8814accf12674f2dc 0x215ab1ddc9d7b079202371ef5332d37dcfdcd3fc 0xc404df04ce19dbbdd0350e2ea4e7b3eff4ff72dd PeckShield's abbreviation "0xc404...72dd" matches both the real address and the poisoned twin. The real one is 0xc404160b79bd8905061a1caecbeca2eeab3f72dd. CertiK's alert lists three links, but 0x7d4e...f2dc appears twice — the third address was never actually named. ── STATUS ── Cronos has produced no blocks since 14:32:47 UTC on Aug 30. Two independent RPCs agree on the same head, block 90,907,150. That is more than eleven hours. explorer.cronos.org is also down — its backend returns an internal server error on every address, so Tectonic's verified sources are unreadable right now. Everything above was rebuilt from events and archive eth_call, not from source. Against the ~$119.1M hole, the protocol holds the attacker's 5M USDC and 335.7T TONIC of collateral, now worth about $9.8M after the price fell back to $3.0067e-8. Net bad debt is on the order of $105-110M. All USD figures use Tectonic's own oracle at the block before the attack, to keep the manipulated spot out of the arithmetic.

Ajna V2 is still being drained. Coverage says ~$775K across 7 pools, one attacker, past tense. The chain says 13 pools and 6 separate addresses running 6 different exploit contracts — and the newest auction was kicked 10:37 UTC today. etherscan.io/tx/0xa199d8edd9… THE FINGERPRINT — one transaction, every time: addQuoteToken into a bucket far above the pool's top-of-book → drawDebt twice against that self-made price → kick both of your own loans. Wait out the 1-hour take cooldown. Then bucketTake your own bucket from the other auction. Every one of the 13 deposits lands above the incumbent top bucket: cbETH/WETH index 2000 vs 4151 · sUSDe/DAI 1000 vs 4157 · wstETH/WETH 1 vs 4129 THE DEFECT — Ajna already shipped the check that stops this: Pool.removeQuoteToken calls _revertIfAuctionDebtLocked. Deposit backing live auction debt is frozen. TakerActions._takeBucket reaches the same deposit tree at a caller-chosen index and never calls it. At the cbETH take block the frozen band covered the attacker's own bucket: debtInAuction 98.724790 > depositSize 98.687750 → findIndexOfSum returns 7388 → 2000 <= 7388 reverts. depositIndex(1) = 2000. Their bucket was top of book, squarely inside the band the code's own comment calls frozen. The guard exists. It sits on the other function. DRAINED — quote token, pre-attack vs now: sUSDe/DAI 163,371 DAI 99.3% syrupUSDC/USDC 89,921 USDC 97.4% cbETH/WETH 48.88 WETH 99.1% wstETH/WETH 48.62 WETH 95.5% mwstETH-WPUNKS 35.71 wstETH 92.9% WBTC/DAI 28,472 DAI 81.7% WETH/USDC 25,500 USDC 88.6% sDAI/USDC 14,244 USDC 97.6% sDAI/USDC 11,835 USDC 89.5% + 4 smaller pools sUSDe/DAI is the second-largest loss in the campaign and appears in no published breakdown. SIX ACTORS, NOT ONE: 0x6f2f5236 Aug 28 15:18 first mover — 7x1 ETH from Tornado, purpose-built 24,328-byte contract, 1 pool 0xcccc6400 Aug 28 18:27 4 pools 0xc213145e Aug 28 22:12 4 pools 0xb929c721 Aug 28 23:30 1 pool 0x3c443553 Aug 29 00:34 1 pool 0x73433e6b Aug 29 19:12 2 pools, latest today Six exploit contracts, six different bytecode sizes, six different hashes — 24,328 / 11,280 / 8,484 / 12,024 / 12,264 / 11,863 bytes. Five of the six EOAs have long prior histories; only the first is freshly funded from a mixer. That is not one fleet. It reads as the first exploit being reverse-engineered inside three hours and re-run against every remaining pool — and still running 30 hours after the team asked users to withdraw. Mechanism first named publicly in the DeFiHackLabs PoC. Defimon says it flagged the prepared attack over an hour before the first transaction landed.

🚨 Term Finance, day 6: 300 ETH went through Tornado Cash on Aug 24. Term's first on-chain word to the attacker came on Aug 27 — three days and $742K later. The vault has since written down 97.11% of itself. The money moved first Aug 24, 17:27:47 — 100 ETH leaves the consolidation address for a fresh EOA, 0xc1400766…d83e 17:29:59 — a 0.05 ETH test 17:30:23 — 100 ETH into the Tornado Cash router 17:31:47 → 17:31:59 — another 100 ETH, same path 20:52:47 → 20:53:11 — a third 300 ETH, ~$742K at that afternoon's price. The hop wallet is now down to 0.035 ETH. Then Term spoke Aug 27, 17:28:23 — a Safe writes to the attacker in calldata: "this is termfinance.eth. please use 0x78cC562D740f44CCA18AA74126C6dD23F8cFcD38 for comms on blockscan going forward" We checked it three ways before repeating that address, because the last protocol we watched do this got impersonated within hours: termfinance.eth resolves to 0x0842fdfb… — the exact Safe that sent it. The signer 0x1b84ddff… is one of that Safe's three owners. The nominated comms address was first funded on 24 July 2024 by 0x7142b642…, another owner of the same Safe. Two years old, not minted for the occasion. All three hold. This is Term. But it is only a handshake — the follow-up from the comms address says nothing except "please read" and links back to the Safe message. No terms have been offered yet. The writedown On day one we put the real residual of the ETH Meta Vault at 84.47 ETH, derived from a WETH balance of zero against a book that still read 2,926.2159. Today the vault's own totalAssets() reads 84.4709 ETH. Share price has gone from 1.030752 to 0.029756 — a 97.11% writedown. maxDeposit is now 0. The attacker's contract is still sitting inside the vault: 2,841.7435 frWETH-EXIT, exactly as deposited. It is simply worth nothing now, which is what it always was. What is still out there At the consolidation address: 2,543.15 ETH + 1,679,642.45 DAI (~$7.89M). And the two takeovers that were queued and never fired still have their targets intact — Parity Core ETH holds 10.44 ETH, Parity Prime ETH 75.94 ETH. Whether those transactions remain executable is something only Term can answer. Addresses Funds: 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 Tornado hop: 0xc14007663a5bb9f13d4d2aee8c6fe9075ef1d83e Term Safe (termfinance.eth): 0x0842fdfb5940ef6a4ea6c5dee024eec1ddc6977d Term comms: 0x78cC562D740f44CCA18AA74126C6dD23F8cFcD38

🚨 Moonwell / Base — $9.15M bad debt CertiK named the MAMO price manipulation. That alone bought $3.25M of borrowing power; $11.03M was borrowed. The other 72.8% came in through a plain ERC-20 transfer. The mMAMO market has a supply cap: 20,000,000 MAMO. It worked. 09:13:07 UTC — the comptroller rejects a 1,000,000 MAMO mint: "market supply cap reached" 09:19:59 — 34,910,396 MAMO transferred straight to the market contract 09:21:07 — the comptroller now rejects a mint of 1 wei 09:21:09 — 18,482,894 MAMO transferred straight to the market contract basescan.org/tx/0x056597f423… Two logs in that transaction. AccrueInterest, Transfer. No mint, no comptroller call, no cap check, 120,017 gas. Compound-v2 exchange rate is cash ÷ mToken supply. Donating cash re-prices every mToken already outstanding: exchangeRate 0.0205133 → 0.0754604 (3.679x) market cash 18.27M → 71.66M MAMO (3.58x the cap) their collateral 15,089,595 MAMO minted → 55,508,833 MAMO credited THE ARITHMETIC The oracle feed went $0.010482 → $0.431274 (41x) across ~30 multi-pool buys. Two levers, and only one of them was reported: price pump alone, 15.09M minted $3.25M borrowing power price pump + donation $11.97M actually borrowed $11.03M The cap was never the binding constraint. The attack stopped when an AERO borrow was rejected for insufficient liquidity — $1,422 of headroom left. THE HOLE Drawn: 71.355 cbBTC · 623.60 WETH · 2,560,000 USDC · 368 wstETH. Ten liquidators recovered ~$1.8M and dumped the seized MAMO; the price is back at $0.0116. Four of those liquidations were executed by Moonwell's own OEV wrapper. Collateral left on the position: 7.08 MAMO. Bad debt at 11:20 UTC: $9,150,274, accruing. $8.7M is what reached Ethereum. It is not what Moonwell lost. For scale: the entire MAMO inventory across the 21 pools the buys routed through was worth ~$920K before any of this. THE MONEY Aug 21–23 11 Tornado Cash withdrawals Aug 24 1,947,391 USDC bridged to Base over CCTP Aug 25 dry run — 10,000 USDC into Moonwell and back out, two minutes Aug 26 75,000 USDC → 7,407,608 MAMO at $0.010125, 32h ahead Aug 27 582,000 more MAMO borrowed from mMAMO itself 09:41–42 8,729,453 USDC burned to CCTP 09:44:47 8,728,318.997 USDC → DAI in the Maker PSM, 84 seconds after landing 09:45:47 forwarded. Still sitting there, untouched. The USDC was never still long enough to be frozen. RESPONSE 10:53:43 UTC — borrow caps set to 1 wei across all 21 markets. 83 minutes after the last borrow, 71 minutes after the funds left the chain. 11:09:43 UTC — mMAMO supply cap set to 1 wei. Collateral factor untouched at 0.5. Mint and borrow guardians never paused. ADDRESSES Operator 0x719eae70d4A83f35bF82A2740699F5db84BE919D (Base) Treasury 0xD71dD9B6e634412713c47fe7aE02c628e338C384 (Base + Ethereum) mMAMO 0x2F90Bb22eB3979f5FfAd31EA6C3F0792ca66dA32 mcbBTC 0xf877ACAFa28c19b96727966690b2f44d35ad5976 Mechanism first reported by CertiK. This is what their alert leaves out.

Blend's backstop — the insurance layer behind every Blend lending pool on Stellar — went from $3.92M to $257 in thirteen hours. It started when someone swapped USDC for USDC. Comet, the AMM holding that collateral, never checks token_in != token_out. Neither does Balancer V1, which it forks — and Balancer is fine anyway, because `Record storage` makes both names alias one slot, so `+in` and `−out` compose. Comet's Rust port reads a copy of the map entry and writes both back (pool.rs:202-203). The second set discards the first. The recorded reserve falls by the full amount_in while the real balance rises. Understate a reserve, deposit into it, and the pool mints LP shares out of nothing. 36 flash-loan loops. 53 minutes. 717,518.92 USDC. The trail is unusually clean, because the attacker's account lived 88 minutes: created by a HitBTC withdrawal at 03:25 UTC, seeded with 30,282 USDC from Binance, 36 exploit txs from 03:51 to 04:44, then 500,000 + 247,800.9234056 USDC to NEAR Intents and account_merge. 747,800.92 out minus 30,282 in. That is the entire P&L. Then nobody paused the pool. Six and a half hours later two more addresses replayed the identical bug — 355 further transactions until 16:56 UTC — and took the remaining 73.9M BLND. BLND is down 92.6%. Blend V2's backstop holds 99.925% of the pool's LP shares. It is still auto-depositing BLND emissions into the empty pool: 4,032 BLND this morning. Audited by OtterSec, January 2024. 11 findings, 0 critical. The bug shipped 844 days ago.